Linux 6.1 To 6.5 Git Quietly Patched For "StackRot" Privilege Escalation Vulnerability

It's now more clear why last week Linus Torvalds personally took to improving the Linux kernel's user-mode stack expansion code: it's necessary to address a now disclosed security vulnerability dubbed StackRot.

StackRot is a Linux kernel privilege escalation vulnerability that saw an "early" disclosure last night. StackRot impacts Linux 6.1 and newer except for the very latest point releases in the past week picking up Torvalds' code changes. This kernel privilege escalation vulnerability is within the memory management code and thus wide exposure on the broad kernel configurations impacted.

The disclosure by Ruihan Li sums up the exposure as:

"...it affects almost all kernel configurations and requires minimal capabilities to trigger. However, it should be noted that maple nodes are freed using RCU callbacks, delaying the actual memory deallocation until after the RCU grace period. Consequently, exploiting this vulnerability is considered challenging."

This use-after-free-by-RCU driven vulnerability has been present since last September when moving the VMA tree structure to Maple Trees. Linux 6.1.37, Linux 6.3.11, Linux 6.4.1, and Linux 6.5 Git are all safeguarded against StackRot thanks to Linus Torvalds' coding.

More details on the StackRot vulnerability via the oss-security list.